The npm package 'create-response' version 99.0.0 has been identified as containing malicious code. This package communicates with domains linked to malicious activity and executes commands associated with harmful behavior. It is flagged as a malicious package by the OpenSSF Package Analysis project and Amazon Inspector.
The npm package 'int_affirm_controllers' version 99.0.0 has been identified as malicious. It contains code that communicates with domains linked to malicious activity and executes commands associated with harmful behavior. This package poses a security risk to users who install or use it.
The npm package 'app_storefront_core' version 99.0.0 has been identified as containing malicious code. It communicates with domains linked to malicious activity and executes commands associated with harmful behavior. This package poses a security risk to users who install or use this specific version.
Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.
The example-nestjs-api npm package versions 10.0.1 and 99.9.9 contain malicious code. This issue is identified as a malicious package threat without detailed technical or impact information provided. No CVSS score or exploit in the wild has been reported.
The sqlcommenter_rails RubyGem versions 0.1.0 and 99.0.1 have been identified as containing malicious code. This is a supply chain threat involving a malicious package published to the RubyGems ecosystem. No CVSS score or detailed technical exploitation information is provided.
The RubyGems package 'your-gem-name12' version 99.0.1 has been identified as containing malicious code. This is a supply chain threat where the package itself is intentionally harmful. No official patch or remediation guidance is currently provided. There are no known exploits in the wild at this time.
A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.
A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
The RubyGems package 'advisory_db_toolkit' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. The package is considered malicious because it executes one or more commands associated with malicious behavior. There is no CVSS score or detailed technical exploit information available. No patch or remediation guidance is provided.
The RubyGems package 'secret-scanning-proto' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior. There is no CVSS score available for this threat. No patch or remediation guidance is provided in the available data.
The turboscan-client RubyGems package version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior, posing a security risk to users who install or run it. There is no CVSS score available for this threat, and no official patch or remediation guidance has been provided. No known exploits in the wild have been reported. Users should avoid using this specific package version to prevent potential compromise.
The RubyGems package 'proto-trust-metadata-api' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior. There is no CVSS score available for this threat. No official patch or remediation guidance is provided in the available data.
The RubyGems package 'prose_diff' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior. No official patch or remediation guidance is currently provided. There are no known exploits in the wild at this time. The package should be treated as a security risk due to its malicious nature.
The RubyGems package 'turboghas-client' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior, posing a security risk to users who install or run it. There is no CVSS score available for this threat. No official patch or remediation guidance is provided, and no known exploits in the wild have been reported.